Strange Auto-Forwarding

Skip to first unread message

Nov 28, 2022, 10:22:51 AM11/28/22
to ntexchange
Hey all,
I have some funny entries, which of course do not resolve to anything when I click them and I cannot see them in Powershell.

They looks like maybe they are hashes

All go from this domain to some of our other external domains , all having connectors.

My first though is an Indicator of Compromise .. but it's cause I assume the worse.


Michael B. Smith

Nov 28, 2022, 10:26:27 AM11/28/22

What was the account that created the emails and what is that accounts purpose?





Michael B. Smith

Managing Consultant

Smith Consulting, LLC

You received this message because you are subscribed to the Google Groups "ntexchange" group.
To unsubscribe from this group and stop receiving emails from it, send an email to
To view this discussion on the web visit

Nov 28, 2022, 10:36:18 AM11/28/22
to ntexchange
Not sure how to tell (n00b)

Nov 28, 2022, 11:09:41 AM11/28/22
to ntexchange
It appears to be in all our tenants , some are SMTP Forwarding between different Tenants that have a connector,  but in one of our Tenants we see that + Mailbox Rules that forward from that address to various outside domains like,  -- opening a case with M$ now --- too strange.

On Monday, November 28, 2022 at 11:26:27 AM UTC-4 Michael B. Smith wrote:

Nov 28, 2022, 11:44:08 AM11/28/22
to ntexchange
.. and dumb founded ..  he is not sure . To be fair, their Quick Assist tool isn't working to "look"

so now I wait

Michael B. Smith

Nov 28, 2022, 3:46:29 PM11/28/22

If you open the Queue Toolbox on an Exchange Server you can drill down into individual messages to see who sent them. Everything but their content.


I find the data, as you’ve shown it, to be quite suspicious.


Are you current with CUs?

Nov 29, 2022, 6:20:22 AM11/29/22
to ntexchange
How rude of me. This is Exchange Online.  Clicking each message spins.

It's funny, as if I search the odd characters, in almost seems like it's related to DLP ..

The investigation continues , outcome will be shared .
Reply all
Reply to author
0 new messages